Designing and Writing Software - Source vs. Executable Code

Source Code

Source code is a set of statements written in human- readable form that are an implementation of a given design. It consists of words, numbers, operational symbols such as algebraic operators, and punctuation marks; it follows the rules for syntax (or structure) and semantics (how meaning is derived from structure) for a particular programming language.

Executable Code

Executable code, also called object code, is the binary representation of the machine language instruction set that

Many different, correct, and complete source code programs could be written to implement a specific design, with each one reflecting different ideas about programming, in different languages, and using different libraries of supporting subprograms or processes.

the CPU and other hardware of the target computer directly execute.

Intermediate Code

Intermediate code, as its name suggests, is a form of expressing a program's required function that is somewhere between human-readable source code and binary sets of values that can be loaded into memory and executed by a CPU. The most common use of intermediate code is to provide machine independence or portability for a program.

Since many CPUs have different hardware-level instruction sets, this requires specialized software (sometimes called a runtime engine) for each CPU type. Java P-Code and Microsoft's Common Intermediate Language are two very common examples of how source code programs are made extremely portable and mobile.

Arbitrary Code

"Arbitrary code" is not another form of programming language. Many vulnerability reports or software security notices mention that a particular vulnerability, if exploited, could result in what is sometimes called "arbitrary code execution." All this means is that the attacker can fool the CPU into executing a different set of instructions than the designers and builders of the system being attacked had intended it to. Attacks against executable code in which the designed-in sequences of instructions and data, as binary values in memory- are often involved in arbitrary code execution attacks, if the exploit can in effect overwrite the intended contents of memory containing a segment of code with code of the attacker's choice.

In the vast majority of cases, exploitable vulnerabilities are introduced into software at the source code level.

These happen because of errors made as design details are translated from drawings, pseudocode, or text narratives into statements in the selected programming language. Only very, very rarely has an exploitable vulnerability been introduced due to an error in the special software tools that translate a source code program into executable form. That does not, however, mean that malware-infested versions of various software development tools don't exist.